Certified keys may push under a subject grant (keyless step 4b) f0a517d28237

    /// Certificates of short-lived keys that signed what the bundle carries

    /// (spec §14.7), their issuers' identities among `objects`.

    pub certificates: Vec<crate::cert::SignedCertificate>,

        let mut v = Value::map([

        ]);

        // Only when there are any; older peers ignore the field.

        if !b.certificates.is_empty() {

            if let Value::Map(m) = &mut v {

                m.insert(

                    4,

                    Value::Array(

                        b.certificates

                            .iter()

                            .map(|c| Value::Bytes(c.encode()))

                            .collect(),

                    ),

                );

            }

        }

        v

            }

        }

        if let Some(cs) = m.get(&4) {

            for c in o::array(cs, "certificates")? {

                b.certificates.push(

                    crate::cert::SignedCertificate::decode(o::bytes(c, "certificate")?)

                        .map_err(|e| schema(&format!("certificate: {e}")))?,

                );

            certificates: vec![],

        assert!(d.certificates.is_empty());

        // Certificates (keyless, oxygenhub#241) travel as field 4, only

        // when there are any: a bundle without them encodes as before.

        let plain = wire::encode_bundle(&bundle);

        let mut with = bundle.clone();

        let issuer_sk = crate::identity::SecretKey::generate();

        let issuer = issuer_sk.identity("hub", "h@x", 1);

        with.certificates.push(crate::cert::SignedCertificate::sign(

            crate::cert::Certificate {

                key: id.clone(),

                issuer: issuer.hash(),

                subject: "agent:a@b".into(),

                claims: vec![],

                scope: crate::identity::Scope::CHANGES,

                not_before: 1,

                expires: 2,

            },

            &issuer,

            &issuer_sk,

        ));

        let encoded = wire::encode_bundle(&with);

        assert_ne!(encoded, plain);

        assert_eq!(

            wire::decode_bundle(&encoded).unwrap().certificates,

            with.certificates

        );

        with.certificates.clear();

        assert_eq!(wire::encode_bundle(&with), plain);

        // A rule of certified subjects alone stays.

        p.rules

            .retain(|r| !r.keys.is_empty() || !r.subjects.is_empty());

                // A change is checked when it is received: now is a time

                // its signer did not choose.

                    .any(|k| policy.succeeds(k, &key) || policy.succeeds(k, &principal))

                    || self.certified_authorized(

                        policy,

                        &key,

                        reference,

                        crate::identity::Scope::CHANGES,

                        crate::objects::Hlc::now().wall_ms,

                    );

        self.attach_certificates(&mut bundle)?;

    /// Add the certificates of short-lived keys that signed what `bundle`

    /// carries, and their issuers' identities, so a receiver can tell who

    /// they stand for (spec §14.7). `also` names more signers (a reference

    /// attestation sent beside the bundle).

    pub(crate) fn attach_certificates_for(

        &self,

        bundle: &mut Bundle,

        also: &[KeyId],

    ) -> Result<()> {

        let mut keys: BTreeSet<KeyId> = also.iter().copied().collect();

        keys.extend(

            bundle

                .changes

                .iter()

                .flat_map(|(_, s)| s.iter().map(|s| s.key)),

        );

        keys.extend(

            bundle

                .raw_changes

                .iter()

                .flat_map(|(_, s)| s.iter().map(|s| s.key)),

        );

        keys.extend(

            bundle

                .attests

                .iter()

                .flat_map(|a| a.sigs.iter().map(|s| s.key)),

        );

        for k in keys {

            let Some(r) = self.store.certificate_of(&k)? else {

                continue;

            };

            let cert = self.store.get_certificate(&r)?;

            if bundle

                .certificates

                .iter()

                .any(|c| c.cert.hash() == cert.cert.hash())

            {

                continue;

            }

            for id in [&k, &cert.cert.issuer] {

                if let Ok(body) = self.store.get_typed(id, ObjectType::Identity) {

                    if !bundle

                        .objects

                        .iter()

                        .any(|(t, b)| *t == ObjectType::Identity && *b == body)

                    {

                        bundle.objects.push((ObjectType::Identity, body));

                    }

                }

            }

            bundle.certificates.push(cert);

        }

        Ok(())

    }

    fn attach_certificates(&self, bundle: &mut Bundle) -> Result<()> {

        self.attach_certificates_for(bundle, &[])

    }

    /// Keep the certificates a bundle brings once each verifies with the

    /// identity of the issuer it names; one that does not refuses the bundle.

    fn adopt_certificates(&self, certs: &[crate::cert::SignedCertificate]) -> Result<()> {

        for c in certs {

            let issuer = self.store.get_identity(&c.cert.issuer).map_err(|_| {

                RepoError::Msg(format!(

                    "a certificate names issuer {}, whose identity did not come with it",

                    c.cert.issuer.short(12)

                ))

            })?;

            c.verify(&issuer)

                .map_err(|e| RepoError::Msg(format!("a certificate does not verify: {e}")))?;

            self.store.put_identity(&c.cert.key)?;

            self.store.put_certificate(c)?;

        }

        Ok(())

    }

    /// A signer authorized for `reference` by what an issuer certified it

    /// as (spec §14.7): a short-lived key with a kept certificate that

    /// verifies with its issuer, gives `scope`, covers `at_ms` (a time the

    /// signer did not choose) and names a subject the policy grants.

    pub(crate) fn certified_authorized(

        &self,

        p: &crate::policy::Policy,

        signer: &KeyId,

        reference: &str,

        scope: Scope,

        at_ms: u64,

    ) -> bool {

        let Ok(Some(r)) = self.store.certificate_of(signer) else {

            return false;

        };

        let Ok(c) = self.store.get_certificate(&r) else {

            return false;

        };

        let Some(issuer) = p

            .identity(&c.cert.issuer)

            .cloned()

            .or_else(|| self.store.get_identity(&c.cert.issuer).ok())

        else {

            return false;

        };

        c.verify(&issuer).is_ok()

            && c.cert.key_id() == *signer

            && c.cert.covers(scope, at_ms)

            && p.subject_grant(reference, &c.cert.issuer, &c.cert.subject, scope)

    }

        self.adopt_certificates(&bundle.certificates)?;

            // Received now: the receiver's own clock is the trusted time.

            let now = Hlc::now().wall_ms;

                && !self.certified_authorized(p, &signer, &u.name, Scope::REFS, now)

            // Received now: the receiver's own clock is the trusted time.

            let now = Hlc::now().wall_ms;

                && !self.certified_authorized(p, &signer, &u.name, Scope::REFS, now)

                // Until the host countersigns when it accepted the update,

                // the attestation's own time is all a fetch has.

                    && !self.certified_authorized(

                        p,

                        &signer,

                        &r.name,

                        Scope::REFS,

                        sa.attest.hlc.wall_ms,

                    )

            // A short-lived signing key's certificate goes with it (§14.7).

            let signers: Vec<KeyId> = self.signing_key().into_iter().collect();

            self.attach_certificates_for(&mut bundle, &signers)?;

/// Keyless step 4 (oxygenhub#241): an agent signing with a short-lived

/// key whose certificate an issuer gave pushes when the policy grants its

/// subject, and a fetch accepts what it attested; an expired certificate,

/// or a subject the policy does not grant, may not move the bookmark.

fn a_certified_key_pushes_under_a_subject_grant() {

    use crate::cert::{Certificate, SignedCertificate};

    use crate::identity::Scope;

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let _origin = Repo::init(&root.join("origin")).unwrap();

    let url = root.join("origin").to_string_lossy().to_string();

    let mut a = Repo::clone(&url, &root.join("a"))

        .unwrap()

        .with_home(root.join("home-a"));

    a.create_identity("Ada", "[email protected]", IdentityScope::User)

        .unwrap();

    write(&root.join("a"), "a.txt", b"a\n");

    a.commit("a", &[]).unwrap();

    a.policy_init().unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    let hub_sk = SecretKey::generate();

    let hub = hub_sk.identity("hub", "[email protected]", 1);

    a.policy_grant_subject(

        "agent:claude@ada",

        hub.clone(),

        Scope::CHANGES | Scope::REFS,

        None,

    )

    .unwrap();

    assert!(a

        .push("origin", false)

        .unwrap()

        .iter()

        .any(|r| r.name == "policy" && r.ok));

    let now = Hlc::now().wall_ms;

    // An agent repository whose key the hub certified for `subject`, from

    // `from` to `to`.

    let agent = |name: &str, subject: &str, from: u64, to: u64| {

        let mut r = Repo::clone(&url, &root.join(name))

            .unwrap()

            .with_home(root.join(format!("home-{name}")));

        let (_, id) = r

            .create_identity(name, "[email protected]", IdentityScope::User)

            .unwrap();

        let cert = SignedCertificate::sign(

            Certificate {

                key: id,

                issuer: hub.hash(),

                subject: subject.into(),

                claims: vec![],

                scope: Scope::CHANGES | Scope::REFS,

                not_before: from,

                expires: to,

            },

            &hub,

            &hub_sk,

        );

        r.store().put_identity(&hub).unwrap();

        r.store().put_certificate(&cert).unwrap();

        write(&root.join(name), &format!("{name}.txt"), b"agent work\n");

        r.commit("work", &[]).unwrap();

        r

    };

    let claude = agent("claude", "agent:claude@ada", now - 60_000, now + 600_000);

    let r = claude.push("origin", false).unwrap();

    assert!(r.iter().all(|x| x.ok), "{r:?}");

    // Ada's fetch accepts the bookmark the certified key attested.

    a.pull("origin").unwrap();

    assert!(a.bookmark_heads().unwrap().iter().any(|h| a

        .store()

        .get_change(h)

        .map(|c| c.message == "work")

        .unwrap_or(false)));

    let late = agent("late", "agent:claude@ada", now - 1_200_000, now - 600_000);

    let r = late.push("origin", false).unwrap();

    assert!(

        !r[0].ok && r[0].reason.contains("may not update"),

        "an expired certificate: {r:?}"

    );

    let other = agent("other", "agent:mallory@ada", now - 60_000, now + 600_000);

    let r = other.push("origin", false).unwrap();

    assert!(

        !r[0].ok && r[0].reason.contains("may not update"),

        "a subject not granted: {r:?}"

    );

}

#[test]

- A rule may also grant **subjects an issuer certifies** (§14.7): `oxy policy grant-subject SUBJECT --issuer IDENTITY --scope SCOPES` adds `{pattern, issuer, scope}` and embeds the issuer's identity. A signer is then authorized when it is a short-lived key whose certificate verifies with that issuer, names a subject the pattern matches, gives the scope needed (`changes` for changes, `refs` for reference attestations and tags) and covers a time the signer did not choose; it counts as one signer toward the threshold. A rule with subjects only has no keys, and its threshold counts keys and subjects together. The time is the receiver's own clock when it receives a push (changes and the reference attestation), and, until a host countersigns when it accepted an update (oxygenhub docs/keyless.md, step 4c), the attestation's own time on a fetch, which is weaker: a key whose certificate expired could backdate an attestation within its scope. A policy without subjects encodes as before (field 5 is left out), so its hash is unchanged.

| `Bundle` | `{0: [[change bytes, [Signature]]], 1: [signed attestation], 2: [[type name, object bytes]], 3: [signed policy]}`; changes in dependency order; objects are chunks, blobs, identities, and states only, and include the text blobs of every change in the bundle and their chunks, so a bundle can be read on its own; a push that moves a bookmark also carries the identity that signed the move and, for a delegate, the identity it acts for, so a receiver that has seen no change by that key can check it (oxygenhub#129); key 3 (optional) holds the policies between the receiver's serial and the one sent with a push, ascending; key 4 (optional, only when there are any) holds signed certificates (§14.7) of short-lived keys that signed what the bundle carries or the push's attestation, their keys' and issuers' identities among the objects; a receiver keeps each that verifies with its issuer and refuses a bundle with one that does not |